Skip to content
pqdoctor

Proxies

Terminal window
pqdoctor example.org --proxy http://proxy.corp:3128
pqdoctor example.org --proxy socks5://127.0.0.1:1080
pqdoctor example.org --proxy socks5h://user:pass@127.0.0.1:9050
pqdoctor ssh git.example.org --proxy socks5h://127.0.0.1:1080

Every TCP connection goes through it: the key-exchange probes, the group survey, the certificate check, STARTTLS, SSH, --audit, --middlebox, and the port-80 Server header request.

Scheme Who resolves names Default port
http:// The proxy (pqdoctor sends CONNECT name:port) 8080
socks5:// pqdoctor, here; the proxy gets an address 1080
socks5h:// The proxy; nothing is looked up here 1080
  • user:pass@ works for all three: Basic Proxy-Authorization for HTTP, RFC 1929 for SOCKS5. Percent-encode @ and : in them. The password is never printed: reports show socks5h://***@host:port.
  • When the proxy resolves names, the report’s ip is null and only one address is checked (the proxy picks it).
  • https:// proxies (TLS to the proxy itself) aren’t supported.
  • QUIC and DTLS are UDP and can’t go through these proxies.

Tested against a local fake HTTP CONNECT / SOCKS5 proxy (with and without credentials), not yet against Squid, Dante or Tor.

To use one every time, put it in the config file:

proxy = socks5h://127.0.0.1:1080